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This report presents the results of the subject review. Your written responses to the draft report 
are included as exhibits with excerpts and the Office of Inspector General’s position incorporated 
into the relevant sections of the report. The written responses contained sufficient justification to 
reach management decision on Recommendation No. 5. Please follow Departmental and internal 
agency procedures in forwarding final action correspondence to the Office of the Chief Financial 
Officer. 


Based on the responses, management decision has not been reached on Recommendations 
Nos. 1, 2, 3, 4, 6, 7, 8, 9 and 10. The information needed to reach management decision is set 
forth in the OIG Position section after each recommendation. In accordance with Departmental 
Regulation 1720-1, please furnish a reply within 60 days showing the actual or planned 
timeframes for implementing each audit recommendation. Please note that the regulation 
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requires a management decision to be reached on all findings and recommendations within a 
maximum of 6 months from report issuance, and final action to be taken within 1 year of each 
management decision. 


We appreciate the courtesies and cooperation extended to us by members of your staff during the 
review. 


~ 
\ 
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JOYCE N. FLEISCHMAN 
Acting Inspector General 
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Executive Summa 


Oversight and Security of Biological Agents at Laboratories Operated by the U.S. 
Department of Agriculture (Audit Report No. 50099-13-At) 


Results in Brief Recent terrorist acts in this country, including the anthrax attacks on 
Government and media officials, underscore the importance of security over 
biological agents—organisms that in the wrong hands could pose a risk to 
human health and agricultural production in the United States. Because of its 
mission, the U.S. Department of Agriculture (USDA) performs research and 
diagnostic testing in laboratories across the country in which it uses and 
stores agents that could potentially be used in terrorist attacks. 


We began our audit of USDA laboratories in April 2001. Our objectives 
were to determine the extent and location of agents that are pathogenic to 
humans or injurious to agriculture, the adequacy of procedures to guard 
against the accidental or illegal release of these agents, and the adequacy of 
security to prevent unauthorized access and removal of the agents. The 
events of September 11, 2001, gave new urgency to our review. 


USDA operates approximately 336 laboratories throughout the country. The 
biosafety levels of the agents used or stored in the laboratories are classified 
according to their risk of harming animals or plants—high risk if causing 
potentially lethal infection, low risk if posing little danger of infection.! High 
risk agents include those known to be zoonotic—transmissible from animals 
to humans. Most USDA laboratories use or store moderate or low risk 
agents. Some use or store high risk agents. 


We found that security of biological agents at USDA laboratories was 
inconsistent and generally in need of improvement. Before September 11, 
biosecurity was not a major concern at the laboratories because previous 
break-ins did not appear to result in the theft of biological agents. Moreover, 
the Department’s emphasis had been on ensunng that laboratory personnel 
were protected against biological agents, rather than ensuring that such 
material was not accessible to unauthorized individuals. Consequently, the 
Department had issued no policies and procedures for agencies to implement 
to manage security at the laboratories and to centralize control of field unit 
practices involving the use and storage of biological agents. 


Of particular concern was the absence of a consolidated database to allow 
agency managers to identify the location and risk levels of the biological 
agents at laboratories across the country. Without such a database, agency 


' The Department adopted its biosafety level classifications from the Centers for Disease Control and Prevention, whose 
guidance was limited to those biological agents posing a risk to humans. The Agricultural Research Service applied this 
guidance to agents posing a risk to plants and animals. 

a nnn a cme 


USDA/OIG-Audit No. 50099-13-At i 





























ey e % “remmud Sviiioos 


) of) Va betrienO eettole ods oj te os m in poll Yo viet’ Gaeq tet ev 
1A-Et-NOSOE .ct Pogen Th rh’, qradioseges to rie 


‘wee mi «i wow denote? igeped whe at g 


» YING wet : ott) BM Ao aber hoe %: as ae 
; ) } POT Sak fort? eniciiegie—atirgt lergolars 


. if Dan q hetq Lewilnotiges Gis Anson worm 
5 dywer ro f 27Ul) sudan treet) 2.) ofl) onan 


cis wiciogal 1) wruts , crmith 
i) 30 VI 7 Dou ar) ants Poe 


Be oi (ms ‘if ho Ww < sw 
. i Li xy 13 3 jimrimar) @f- sae 
nibs Wij, 3 1 | guceioin Fs regeel 


etsy rics io lefréiwoon al) Wee 
‘ ye W . pyr is : 
/ {| we ‘ ’ 
: ; ; : s-4euon AGE) 
ty ' j movi Wo } ' \2Ne 
A : a) : 7 : ae 
} trols tain 
{ t nl il 4 ’ i evt 
7 ACi2i) jeolr 1)98 € 
1 ' g’ 
cw Fornoll a) BOT OMH i to vinivoee ied) Snel ow 
soit ye SV wel ontavercen| lo baen af viletsney One MoyeenYy Pill 
vO? i bul Ge) : in OO wien & TOM Fry Ww tom ¥ 
raue inagh te flasiy oc!) al feat of sans jon Ob eti}-MaIS 
t(j m epuumodal entiiirts co aged bed seniqis 9 ingrid Al Si ; 
oy sco aetiwens “ ny, 2%, ta a ue wiiava beas*es) q Ad 
iti .~Unpepeane » Bit 1 Bearcoifivenl G sidizzesas Ina Baw LOso™alD 
erro lage o gi3rts mi | awce* bie en mo Ta | bauer bad pert oneal > * 
| hel Yo fowtnon cstiemeos OF bee eheamedal scr Yirieobe syancia Of 


won hi Hao" be suerte bap sen 98) gar emeni< to uhe1g 


volln ot stedainh & bent crm Yo wort Of > eheine mayne wily si] 1G 
levioloid of 46 aloes! Aan het motisag! ott titnabi ob etayenien. (orage - 
(ONIUe 22200 eee juni? Prat. Gall pata: abe oaeit x iD ioe Sv 


7 


a hs 






sinha nani weet insitotndd seeeet) ssh ctient adv nesit spn 
at: binge <opermt dotooke® ipitlocayA wit weed wt Ug 








i 
am Dy i 7 : 
2 9 
; ry Pies aes 
, * . 7 7 
; i a “ee PP a 





managers cannot determine if the containment and security at the laboratories 
is commensurate with the risk associated with the agents. Indeed, during 
recent Federal attempts to track down the source of the strain of anthrax used 
in the October 2001 anthrax mailings, USDA officials were unable to 
immediately determine whether the Department used or stored that strain. 
Although the laboratories themselves are required to maintain an inventory of 
their biological agents, only some did so, and some of those we reviewed 
were not accurate. At one major laboratory with high risk agents, eight of the 
nine agents we reviewed did not match inventory records. According to an 
official at this laboratory, one vial listed in inventory but not found in storage 
contained about 3 billion doses of Vesicular stomatitis virus, a pathogen of 
considerable risk to humans and cattle. This laboratory had not updated its 
inventory of high risk agents since 1997. 


The absence of a centralized database has already resulted in 
post-September 11 misinformation and improper reporting. During the 
month of October, the Secretary, acting on information provided by agency 
officials, reported to the Office of Homeland Security that one laboratory 
known for its work with high-risk agents was no longer using the agents. We 
found that the laboratory continued to store and experiment with Bluetongue 
virus and Vesicular stomatitis virus, both of which are considered zoonotic 
and restricted agents by the Centers for Disease Control and Prevention. 
However, we also noted that anthrax was not used or stored in any location 
not designated for it. 


We reviewed the security of 124 USDA laboratories located at 91 sites across 
the country. Security measures at almost half of these sites needed 
improvements of some sort. Alarm systems, security fences, and surveillance 
cameras were commonly lacking. Previous internal security reviews had 
identified many deficiencies, and laboratory directors were generally aware 
of the necessary upgrades, but these were slow in coming due to funding 
constraints and pre-September 11 management priorities. For example, a 
security survey conducted at several Department laboratories recommended 
perimeter fencing, but while the lower risk laboratories got the fencing, 
funding constraints left the higher risk laboratories without. Additionally, 
some field laboratories that were not near their central facilities, such as one 
laboratory situated in a strip mall, appeared to be at greater risk because of 
their locations. Such laboratories should be consolidated with more secure 
facilities. 


The Department also did not adequately control access to biological agents 
by personnel entering the laboratories. At several laboratories, scientists and 
researchers not associated with USDA work had ready access to units where 
biological agents were stored. Some of the scientists and researchers were 
non-US citizens. Not all of the laboratories had received any 
post-September 11 instructions regarding access by visiting researchers or 
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others with keys to the laboratories. Because of a backlog of security 
background checks, access was routinely granted to researchers whose 
background checks had not been completed. A lack of policy on background 
checks resulted in access inconsistencies. One laboratory official considered 
a visa as fulfillment of the agency’s requirement for a background check. 


Finally, the Department needs to institute procedures for laboratories to 
report to their agency headquarters any incidences of unauthorized access. 
Although laboratories are currently required to report vandalism or break-ins 
to OIG and the Department’s Office of Crisis Planning and Management, 
there is no requirement that the laboratories inform their agency managers of 
these incidents. In practice, some laboratories have only been informing the 
local police. Without specific reporting requirements, agency officials cannot 
manage the security of their laboratory networks and cannot know when 
security levels are inadequate. 


Recognizing the need for greater biosecurity in the wake of the September 11 
attacks, the Secretary assigned a task force to develop policies and 
procedures for biosecurity issues within the Department. The task force’s 
goal was to draft standards in four key areas: inventory control, physical 
security, personnel security, and biosecurity incident response. On 
November 9, 2001, the Deputy Secretary signed the decision memorandum 
for the Secretary of Agriculture adopting the policies and procedures 
developed by the task force and directed USDA agencies to implement them. 
Currently, USDA agencies are drafting plans to implement the policies and 
procedures. The document establishes policy for all pathogens deemed of 
particular sensitivity by USDA, whether those pathogens had previously been 
identified as high risk or not. The Department is currently finalizing the 
policies and procedures into a Departmental Regulation. 


During our audit, additional congressional funding has been forthcoming to 
strengthen the Department’s biosecurity programs. On January 10, 2002, 
President Bush signed the Defense Appropriations Act, which included 
$328 million for USDA for security upgrades and other activities in response 
to terrorist attacks. Emphasizing protection of the Nation’s food supply, the 
Act designates $119 million for the Animal and Plant Health Inspection 
Service (APHIS), $113 million for the Agricultural Research Service (ARS), 
and $15 million for the Food Safety Inspection Service (FSIS). The 
remaining $80 million is designated for other USDA homeland security 
priorities. These funds should help USDA attain the high level of security 
needed to keep biological agents from falling into the wrong hands. 


Note: Because of the sensitivity of the issues contained in this report, we 
have presented our findings in general rather than specific terms. We have 
refrained from naming any of the laboratories we visited or specifying any of 
their locations. A separate document containing this information will be 
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presented to Department managers for their use in implementing our 
recommendations. 


Recommendations 


In Brief We are recommending that the Department hasten the implementation of the 
policies and procedures established by its task force and that it complete a 
centralized database of all its biological agents. Once the database is 
complete, agency managers need to assess the risks associated with each 
laboratory site and determine what security measures are needed to mitigate 
those risks. Agencies also need to revisit previous internal security reviews 
and, with the additional funding provided by Congress, implement corrective 
actions immediately. One such action would include relocating the 
laboratory currently situated in a strip mall. 


We are recommending that agencies limit access to high risk or high 
consequence biological agents, and that the Department determine what 
security background checks are needed for personnel with such access. The 
Department also needs to reduce the backlog of background checks. 


We are recommending that the Department correct the inventory and security 
problems at the laboratory that the Department inaccurately reported as no 
longer using high risk or high consequence biological agents. 


Finally, we are recommending that the agencies issue a notice to all 
laboratories to report any break-ins or vandalism to the appropriate Federal 
officials. 


Agency 

Responses The agencies responded that they either have controls in place or are 
instituting controls to bring their laboratories into compliance with the 
Department’s new policies and procedures. They also responded that, for the 
most part, their laboratories have either taken inventories of biological agents 
on hand or are in the process of doing so. Both ARS and APHIS 
acknowledged that they plan to perform a risk assessment once their 
inventories are complete. FSIS, the Forest Service, and the Agricultural 
Marketing Service (AMS) stated they had already completed a risk 
assessment. 


Increased security has been provided at those high-risk laboratories that had 
previously been found deficient. The laboratory located in a strip mall is 
going to be relocated to a more secure area. ARS and APHIS stated that 
since September 11, they have communicated with their laboratories on all 
security issues, including reporting incidents to the appropriate officials. 
AMS stated it is confident that security and control measures in place are 
appropriate. 
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Regarding background checks and unlimited access to biological agents, both 
APHIS and ARS responded that these issues are covered in the policies and 
procedures developed by the USDA task force. Both agencies stated that 
they plan to implement these policies and procedures, as long as funding is 
not a concern. 


OIG 
Position While we acknowledge that most of the agencies have put forth a determined 


effort to improve communications with their laboratories and to implement 
the Department’s new policies and procedures, we also concluded that more 
needed to be done in several key areas. The most prominent area is a 
centralized database. Such a database is critical to Department-level 
management of biological agents, and we urge the agencies to finish 
consolidating their inventories at the agency and Department levels. 


We also urge all agencies to adhere to the doctrines of the task force policies 
and implement those policies at all laboratories with biological agents, not 
just those classified as high-risk. 


Actions necessary to accept the Department’s and agencies’ management 
decisions are provided in the Recommendation sections of the report. The 
Department’s and agencies’ written responses are included as exhibits A, B, 
Cr De iyanc bor ine report: 
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Background and Objectives 


Background 


Through its various agencies, USDA carries on research or diagnostics of 
animal and plant diseases at its own facilities throughout the United States. 
The Agricultural Research Service (ARS) operates the largest number of 
laboratories, 243 at 113 locations, and the Forest Service operates 77 at 
67 locations. Other agencies have fewer laboratories. For example, the 
Animal and Plant Health Inspection Service (APHIS) has four laboratories at 
three locations, and the Food Safety and Inspection Service (FSIS) has 
four laboratories at three locations. 


Biological agents are living organisms in their microbial form. Those used in 
USDA research and diagnostics are generally pathogenic, or 
disease-producing, to some degree. Citrus canker, for example, is pathogenic 
to citrus crops but not to animals or humans. Similarly, Foot and Mouth 
Disease is pathogenic to animals but not to plants or humans. USDA 
scientists work with both animal and plant pathogens that pose a threat to 
U.S. agriculture. They also work with pathogens, such as Avian influenza 
virus, that are regarded as zoonotic. These can cause disease, even death, in 
both animals and humans. 


The Centers for Disease Control and Prevention (CDC) assigns to each 
biological agent that is considered harmful to humans a biosafety level (BSL) 
that indicates what laboratory equipment and practices are needed to ensure 
containment of that agent. Laboratories that work with agents that have a 
low risk of infecting people are classified as BSL-1 laboratories. 
Laboratories that work with agents of moderate risk (e.g., E. coli, 
Salmonella)’ are classified as BSL-2. Laboratories that use agents that may 
cause lethal infections as a result of exposure by inhalation (e.g., Rift Valley 
Fever) are classified as BSL-3. Bacillus anthracis (anthrax), the agent used 
in mailing attacks that resulted in several deaths, 1s considered a BSL-2 agent 
in the strain used in USDA laboratories. 


Adopting the criteria used by CDC to arrive at a BSL-3 classification, ARS 
has developed a category for BSL-3Ag agents. The ARS listing for this 
classification includes additional agents (such as viruses, bacteria, and toxins) 
that are considered potentially lethal to animals and plants. Although CDC 
classifies Bluetongue virus and other like pathogens as BSL-2 agents, ARS 
regards them as having considerable consequence to agriculture and classifies 
them as BSL-3Ag agents. 


? These examples were taken from the CDC list of BSL-2 agents. 
> This example was taken from the CDC list of BSL-3 agents. 
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USDA laboratories that study practices like soil and water management or 
forest management are not assigned a biosafety classification because the 
material they work with is not considered a biological agent. 


We began our audit in April 2001, well before the terrorist attacks on 
September 11. At that time, we focused our work on ARS and APHIS, since 
they appeared to use and store the majority of biological agents as well as 
those agents that were classified at the highest biosafety level. However, the 
events of September 11 and the subsequent anthrax attacks on Government 
and media figures gave greater urgency to our work and persuaded us to 
increase our scope and accelerate our fieldwork. On September 13, Congress 
amended an appropriations bill to require the President “to undertake 
appropriate actions to enhance the standards for the physical protection and 
security of biological pathogens...at research laboratories in the United States 
that create, possess, handle, store, or transport such pathogens in order to 
protect against the theft or other wrongful diversion of such pathogens.” 
Conditions that may not have reflected serious deficiencies before 
September 11 had to be viewed more critically thereafter. 


Of most concern to us was the absence of a centralized database that agency 
managers could use to determine where biological agents were located and 
what security measures would be appropriate for each location. On 
September 24, 2001, after visiting 10 laboratories at 4 sites, we issued a 
management alert to the Under Secretaries for Research, Education, and 
Economics, and for Marketing and Regulatory Programs, recommending 
among other things that the Department’s agencies establish such a 
centralized database and use it to assess the security risk at each site. 


During the month of October 2001, the Secretary, acting on information 
provided by agency officials, reported to the Office of Homeland Security 
that the Department had secured all research buildings, laboratories, 
pathogens, and personnel. The Secretary also stated that an ARS laboratory 
that had previously been using BSL-3 agents was no longer doing so. 
Departmental documentation noted, however, that agencies still had no 
centralized inventory of the biological agents under their control, a fact 
confirmed by our own field reviews. We consequently questioned the basis 
for the agencies’ assurances to the Secretary. 


To answer these questions, we visited another 114 laboratories located at 
87 sites’ to determine if the laboratories were appropriately secured and if the 
agencies had contacted their laboratories as a result of our September 24 
management alert. We found that the situation had not significantly changed; 


4 Sites often house more than one laboratory. It is not unusual to find several laboratories with different biosafety 
classifications located side by side at the same site. 
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few laboratory officials had been contacted by their agency managers, and 
security at the laboratories had not significantly increased. We issued a 
second management alert to this effect on December 10, 2001. 


Objectives The objectives of the audit were to determine (1) the extent and location of 
materials that are either pathogenic to humans or are pests to agricultural 
production, (2) the adequacy of procedures to protect employees and the 
public against accidental or illegal releases of hazardous organisms, and 
(3) the adequacy of security to prevent or minimize unauthorized access and 
removal, including by theft or terrorist attack, of pathogenic organisms from 
departmental facilities. 
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Findings and Recommendations 


Section 1. Department Oversight 


Finding 1 Lack of Emphasis on Biosecurity Resulted in No Departmentwide 
Policies or Procedures 


Until recently, the Department had not formulated policies or published 
procedures for the security of biological agents at the laboratories it operated. 
Prior to September 11, 2001, the Department’s emphasis was on biosafety— 
ensuring that laboratory personnel were protected from the biological agents 
they handled—rather than on biosecurity—ensuring that such materials were 
safeguarded against unauthorized access or release. Without policies and 
procedures, the Department had no consistent oversight of biosecurity 
activities and no centralized control of field unit practices concerning the use 
and storage of biological agents. 


We met with agency officials in April 2001. We learned that with few 
exceptions, the responsibility for dealing with accidents and attacks was 
fragmented among the various laboratory units. Laboratories generally did 
not report security issues to their agencies, and agencies did not report issues 
to the Department. 


Most of the laboratories are located on Federal property throughout the 
United States. Those laboratories using biological agents classified as BSL-3 
or BSL-3Ag are required to follow CDC security guidelines and ARS 
direction.” Otherwise, the individual laboratories decide on security issues 
based on their levels and needs. Some agencies have engaged security 
experts to assess the level of security needed. For example, the Department 
contracted with an outside organization, the Sandia National Laboratories, to 
assess the vulnerability of seven laboratories that work with high 
consequence agents and toxins. ARS has also contracted with the Army to 
review security at one of its major BSL-3 laboratories and offer insights to 
enhance the protection of this facility. 


USDA facilities on colleges and universities are generally located in 
buildings owned by the institution, although some of the buildings are 
Federal property. Access is not restricted on the college and university 
campuses and security at these locations is dependent on the campus security 
officers. Laboratories on campuses are typically more open and accessible 
than those housed on Federal property. Students allowed in the laboratories 
are registered with the college or university, but not with USDA, and security 


° For simplicity, this report will use the BSL-3 classification in reference to all biological agents and laboratories classified 
by ARS as BSL-3Ag or by CDC as BSL-3. 
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background checks are not consistently performed on individuals who are 
granted access to biological agents. 


Although we could find no departmentwide policy on biosecurity, we were 
able to identify specific guidance on issues of biosafety. The USDA Safety 
and Health Manual establishes an occupational safety and health program to 
protect Department employees, the public, and the environment from the 
risks of occupational safety and health hazards and to prevent damage to 
physical property. The safety and health programs are organized at the 
agency level. Each agency may adopt the manual as the required written 
occupational safety and health program or supplement the manual to comply 
with specialized regulatory requirements, which may apply to an individual 
agency’s work. In practice, the agencies further delegated implementation of 
the programs to their field levels. There is no mention of biosecurity in the 
safety and health manual. 


The Department’s organizational structure recognizes both biosafety and 
biosecurity as independent concerns, but it does not offer the same formal 
emphasis on biosecurity as it does on biosafety. The Department’s 
Biological Safety Committee was established in August 1998, according to 
the Safety and Health Manual, which also sets forth the committee’s 
responsibilities. This committee consists of officials from various agencies 
who collectively provide general direction and oversight of the USDA 
Biological Safety Program. The Biological Safety Committee focuses on 
employee safety issues, however, and not on biosecurity or bioterrorism. The 
Department’s Biosecurity Committee, by contrast, existed about 1 year. It 
was subsequently absorbed by the Department’s Homeland Security Council 
Working Group. As an independent committee, the office combined the 
former functions of personnel security, national security, and emergency 
management at USDA. The office staffed an emergency management team 
and did background checks on employees in sensitive positions. According 
to the director of the Office of Crisis Planning and Management, who had 
chaired the Biosecurity Committee, the committee had issued no directives or 
policies during his tenure. 


We noted that at least two USDA agencies, ARS and APHIS, have been 
involved in a Federal interagency working group on biosecurity since the 
group was formed in January 2001. The group, which includes 
representatives from at least five other Federal departments, was constituted 
to establish biosecurity standards analogous to those that already existed for 
biosafety. However, membership in this group by APHIS and ARS did not 
translate into tighter controls within the agency or into a wider awareness of 
biosecurity within USDA. 
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Recommendation 
No. 1 


Agency 
Responses 


Recognizing the need for greater biosecurity in the wake of the September 11 
attacks, the Secretary assigned a task force to develop policies and 
procedures for biosecurity issues within the Department. This task force 
included representatives from ARS, APHIS, the Office of Inspector General, 
the Office of the General Counsel, and the Office of Budget and Program 
Analysis. The task force’s goal was to draft standards in four key areas: 
inventory control, physical security, personnel security, and biosecurity 
incident response. On November 9, 2001, the Deputy Secretary signed the 
decision memorandum for the Secretary of Agriculture adopting the policies 
and procedures developed by the task force and directed USDA agencies to 
implement the policies and procedures in those four key areas. The 
Department is currently finalizing the policies and procedures into a 
Departmental Regulation. In the interim, USDA agencies have been drafting 
plans to implement these policies and procedures. 


Although establishing policy for USDA-held pathogens at BSL-3 facilities, 
the task force document acknowledges that it also pertains to other “high 
consequence pathogens,” as determined by the Department. The task force 
defines “high consequence pathogens” as “those that are not restricted to 
BSL-3 laboratories but are nevertheless deemed of particular sensitivity by 
the USDA—Bacillus anthracis 1s an example.” The task force document 
thus extends Department policy on biological agents to include some 
pathogens that have historically been designated BSL-2. According to the 
task force, these high consequence pathogens will be identified and listed by 
agency administrators. 


In support of the policies and procedures, one of the products planned by the 
Sandia National Laboratories in their assessment of laboratory security is a 
Biosecurity Field Manual and Training Guide. The purpose of the manual is 
to provide the methodology and framework for assessing and improving the 
biosecurity of high consequence microbial agents and toxins both within 
USDA facilities and during the movement of those agents. The Department 
regards the Sandia project as serving to complement the policies and 
procedures developed by the task force. 


We concluded that the Department should implement the task force policies 
and procedures as soon as possible to establish consistent management of 
biosecurity activities and to centralize control of laboratory practices. 


Hasten the implementation of the policies and procedures being prepared by 
the Department’s biosecurity task force. 


FSIS has already established controls at laboratories, and the Forest Service 
has committed itself to implementing the policies and _ procedures 
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immediately upon their issuance. APHIS is in the process of implementing 
the policies and procedures at all of its laboratories, and ARS is developing 
biosecurity controls over BSL-3 materials and laboratories. AMS _ has 
reviewed the policies and procedures and concluded that measures currently 
in place are appropriate. Using the new policies and procedures, it will 
update its Safety and Occupational Health Handbook. 


ARS and APHIS formed a working group to draft an implementation plan on 
biosecurity. The Secretary’s office has also directed that a second working 
group be formed to harmonize the Department’s policies and procedures with 
the security assessments made by Sandia National Laboratories. The 
second working group is scheduled to complete its task by the end of March. 
At that point, the first working group will make all necessary adjustments to 
the draft implementation plan. The ARS Office of Homeland Security will 
continue to coordinate efforts for the protection of ARS physical and 
biological assets. 


OIG Position We concur with the actions taken by FSIS, AMS, the Forest Service, ARS, 
and APHIS to comply with provisions of the Department’s policies and 
procedures for biosecurity. 


However, to reach management decision on this recommendation, ARS, 
APHIS, and the Forest Service need to provide timeframes for implementing 
their biosecurity plans once their working groups have harmonized the 
provisions of the Department’s policies and procedures on biosecurity with 
the security assessments made by Sandia National Laboratories. Also, AMS 
needs to provide a timeframe for updating their Safety and Occupational 


Health Handbook. 
Finding 2 USDA Needs a Consolidated Database to Monitor Biological 
Agents 


The Department did not have a consolidated database to allow agency 
managers to identify the location and containment level of biological agents 
at USDA laboratories across the country. Although many laboratories kept 
inventories of some sort, Headquarters managers did not establish a 
Headquarters repository for the information. Without such a database, 
managers cannot assess the risks associated with the individual materials and 
determine if the current containment and biosecurity levels are appropriate 
for each. Many laboratories did not keep up-to-date inventories themselves 
and consequently could not ensure that the security provided was 
commensurate with the risk involved. Our pre-September 11 review of 
10 laboratories disclosed that security was not considered a priority. Of the 
additional 114 laboratories we visited after September 11, only 34 had 
materially increased security. 
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As a first step toward improving laboratory oversight and assessing the risk 
of unauthorized intrusion and the biosecurity needed to mitigate that risk, 
each laboratory must know what biological agents it stores. USDA’s 
Biological Safety Policy, dated August 31, 1998, requires laboratories to 
conduct inventories of biological agents and their toxins within each facility 
and to identify their effects on humans and the environment. The USDA 
Safety and Health Manual contain program requirements for compliance with 
this policy. These include the development of a site-specific, written 
biohazard control plan. The plan must contain provisions for identifying and 
accounting for all biological agents and their toxins within the facility. 


There is no similar requirement that each agency maintain a centralized 
database of the agents used or stored at laboratories under their 
administration. Such a database would not only strengthen management 
oversight, it would provide for offsite data storage so data could be retrieved 
in the event the laboratory 1s damaged or destroyed. To create such a 
database, comprehensive listings of biological agents at the laboratories must 
be forwarded to Washington, D.C., and updated on a routine basis. 


Agency officials stated that responsibility for maintaining databases of 
biological agents had been delegated to the individual laboratories. While we 
found that most individual laboratories did keep inventories of the biological 
agents they stored, these inventories were sometimes inconsistent and were 
not consolidated or summarized at either the agency or departmental level 
into an up-to-date, centralized database that could readily identify the 
location and risk of the biological organisms. In sum, at the time of our 
audit, the Department was unaware of the type, amount, and location of all 
biological agents handled, stored, or produced in connection with its research 
and diagnostic activities. The Department, therefore, could not provide 
adequate assurance that such biological agents were appropriately secured. 


= Few Laboratories Kept Current Inventories 


We visited 91 sites where USDA laboratories are located. Sixty-two° of 
the 91 sites we visited stored or used biological agents and were therefore 
required to keep inventories, but only 39 did so, and only 22 of the 
39 inventories were updated annually. Generally, individual scientists 
kept inventories of the materials they used in their own research, but these 
inventories were not necessarily monitored by laboratory officials, who 
must determine whether the safeguards in place were adequate. For 
example, a scientist at laboratory A in our sample had experimented with 
Salmonella but had retired and left without informing laboratory officials 


° Twenty-nine of the sites we visited did not use or store any biological agents. 
i 
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that the BSL-2 agent was still in their inventory. In subsequent years, the 
laboratory ceased to operate at the BSL-2 level but still stored the BSL-2 
agent. ’ 


=" Not All Existing Inventories Were Accurate 


Our spot check of available inventory records found six with 
discrepancies. Inventories at two laboratories continued to list biological 
agents that were once used at the sites but were no longer in stock. The 
inventory at a third laboratory listed items that were in stock but were 
mislabeled. In this case, the actual contents of the vials were of the same 
biosafety level as the agents erroneously marked on the labels. More 
notable, however, was the inventory at laboratory B in our sample, which 
stored both BSL-2 and BSL-3 biological agents. The BSL-3 agents were 
last inventoried in 1997. For eight of the nine agents we spotchecked, 
there were either more vials on hand than listed in inventory, fewer vials 
on hand than listed, or vials on hand with no labels. (According to a 
laboratory official, one of the missing vials contained about 
3 billion doses of Vesicular stomatitis virus.) 


An official at laboratory B noted that research assistants sometimes 
misfile agents, and that research students may introduce viruses in 
research projects without updating the inventory. The official also said he 
was not aware of any inventory procedures required by ARS or any 
strengthened security measures mandated after September 11. (This 
laboratory was severely deficient in physical security. pee 
Finding No. 3.) 


Officials at all but 1 of the 91 sites we visited were of the opinion that the 
biological agents they used and stored were appropriately categorized as 
to biosafety level prior to our September 24 management alert and that 
they consequently provided adequate safety against accidental exposure of 
the agents to their staff or the environment. No additional measures had 
been taken after September 24. 


We found that laboratory officials do not always review the accuracy of their 
biosafety classifications and that without an updated inventory they may not 
be able to properly evaluate that classification. This was true of both 
laboratories A and B. As previously noted, laboratory A had ceased to 
operate as a BSL-2 laboratory even though it continued to store a BSL-2 
agent. At laboratory B, we found some BSL-3 agents miscategorized and 
stored with BSL-2 agents in a BSL-2 storage unit. Vesicular stomatitis and 


’ Laboratory personnel informed our auditors that they would destroy this sample once our review brought it to their 


attention. 
Cee eee 
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Epizootic hemorrhagic disease were assigned a BSL-2 classification by the 
laboratory even though ARS has designated them as requiring BSL-3 level 
containment. 


Poorly kept inventories have already resulted in post-September 11 
misinformation and improper reporting. During the month of October, the 
Department reported to the Office of Homeland Security that laboratory B 
was not using BSL-3 agents. We found that the laboratory continued to store 
and experiment with Bluetongue virus and Vesicular stomatitis virus, both of 
which are considered BSL-3 agents by ARS and restricted agents by the 
CDC. 


Not all laboratories were aware of the biosafety level of their agents and 
needed Headquarters guidance to correctly assess the security requirements 
of their facilities. During our review, we became aware of a case in which 
AMS headquarters officials themselves did not know the correct biosafety 
classification of one of their sites. (This site was not one of the locations 
included in our scope, but conditions at the site were verified by an OIG 
auditor.) Initially officials at both the laboratory (laboratory C) and at agency 
headquarters said this laboratory did not contain biological agents and was 
therefore not assigned a biosafety level. We determined that according to 
CDC requirements for the agents used and stored at the laboratory (E£. coli 
and Salmonella), the laboratory should have been classified as a BSL-2 site. 
This confusion demonstrates the need for greater communication between 
managers who must administer Department biosecurity and the laboratory 
personnel engaged in research or diagnostics. 


We concluded that a consolidated database is needed to provide the 
Department and its agencies with better monitoring and oversight of 
biological agents at USDA laboratory facilities. The Department’s new 
policies and procedures also now require inventory controls. The procedures 
call for a local inventory, a consolidated or national inventory, and a working 
inventory (experiments in progress). The consolidated inventory will allow 
agencies to rapidly identify the facilities at which particular agents are in use. 


Recommendation 

No. 2 Direct all agencies to instruct all USDA laboratories to immediately compile 
a comprehensive listing of biological agents handled or stored at their 
respective facilities and to forward this listing to the agency’s headquarters 
for consolidation at the Department level. This inventory record should 
include all laboratories, by agency, showing the biosafety level for each 
facility and a current inventory, which easily identifies all biological agents. 
Ensure that the inventory record is secure and can be readily accessed by 
managers at the headquarters level. Establish a date for accomplishing this 
task. 





USDA/OIG-Audit No. 50099-13-At 10 


S53 3310" & bem | Aw searest) sis ty “val oes 
hed gnitiny g vilinges).@omd BAL, dyooey 

Pe BA 

lacy ; GA. oved asry wie ilvg® 

nh omy oninyl BRUNO Tega LT La 

Te noM Te. seit al) of Spun a dl 

; i 1) REY eT aw won ©- 160 eel (aie 

iio . WoW | (AR 2S! auatnoisu!s five Yngle i> btm 

oe D CMA WE Gta £4124 tyneliiong Pai 


IT] 


eo Tatequadal ; 


f , > 
atts ar. 


U1009) 


1949 Jal lay 


cal fee)st 3 ss 


Wibiie ite), 


eine Ss a | gittt< 
ote) ey 


isfT 
WY eMiwor 


‘ . a # eooieiwral Ty wt 

He er apis i hess 

328% Bb ’ ( “Nicol welts 

f ) Bil ; ete] Loan 4 MA 

lia in it ieeeh> 

TG ' A) ti me of behadeel 
yk i") roan  ylgwinl ( ie 

; itt . lj Seee navpheodt 
) i @ Oo ,gingg a oho) 

\ 16 : Jimnsivoss IT 
lg TOMO i vietrorw ind, Gre 

1%) a Ieotn oiuitas anit 
rrr fi fi r Li sei “407 WIW Piovein 
) at te begets isc *aTaq 

P : 1 iy ima) bebuloe ow 
2 ae Tras A i 43: be tan wystl ; 

"2 i F i PALES Ye arrean i sipntord 
' ; esiiilip mn Ow 430311 

, ; prtotulecerps Ginovin tevol-@ sl igs 
aT i, P ‘ sow OTTERS) eee ne 
yy it j >. paw IV) Tih @S UT Poa) Qeht yistitshy wiley iy er wengs 

@. 
. Hovwil manors ods \I0J ile hewend op exionege Ne al 
a Ga Dash. to inte alipay) } 16 Silbul svete aya & 
fT) Obgst 


i) Grew of Are a iifaat Pee eaG 
ove! Imomre ofl te qoebliqdeee wa 


omg vd 2ehotersig! ie pba sen 


DitehEYiaas tondw VWitewt) Menwes beng yPiligat 


i) boeesone vlibiaer 9c} nea be Siyoe? 2: byes 


at) wridedansoose oa} 9i4k © Meildsied - 


ii 


clervet oi ied want | 


vO. a halohead Sff te ringenei 2 


ome 
; } W a : 
L 


7 / 


a 






7 






































er | 


_ 
= 

7 — 
= 






Prior to September 11, 2001, FSIS and ARS laboratories either maintained 
inventories of biological agents or had begun taking such inventories. After 
the terrorist attacks, FSIS laboratories updated their inventories, and ARS 
expects to complete a validation of its national pathogen inventory by the end 
of March. The Forest Service stated that it did not work with biological 
agents dangerous to humans, only with plant and insect disease organisms. 
The Forest Service will submit an inventory of these organisms to 
Headquarters by June 1, 2002. APHIS stated that its laboratories met their 
January 31, 2002, deadline to transmit their inventories to Headquarters. 
AMS stated on March 18, 2002, that all of its laboratories reviewed and 
updated their biological agent inventories and forwarded copies to 
headquarters. 


Agency 
Responses 


OIG Position We concur with the actions of FSIS, AMS, the Forest Service, ARS and 
APHIS to comply with the Department’s policies and procedures on 
biosecurity by maintaining inventories of all biological agents at each lab and 
consolidating those inventories at the agencies’ headquarters level. However, 
to reach management decision, we need the plan and timeframe for 
development and implementation of the consolidated inventory for the 
Department. 


Recommendation 

No. 3 Based on the inventory of biological agents for each facility, each agency 
should immediately assess the risk associated with such biological agents and 
determine the commensurate biosafety and biosecurity level for such agents. 


Agency 


APHIS plans to begin its risk assessment once it has reviewed all the 
Responses 


inventories submitted by its laboratories. APHIS expects to complete the risk 
assessments by July 31, 2002. AMS stated on March 18, 2002, that it 
reviewed its inventory and found no agents of high consequence and that 
current security and safety measures in place are sufficient for the materials 
handled and stored. ARS stated that it has assigned biosafety levels to all 
2,365 agents in its national pathogen inventory and will implement security 
measures in conjunction with the requirements of the Department’s policies 
and procedures. 


The Forest Service has conducted or is still conducting risk assessments at its 
facilities and will implement corrective measures as appropriate. FSIS 
formed a team of laboratory representatives in September 2001 to assess 
laboratory operations, and based on the team’s critique, it has subsequently 
enhanced existing security plans. 


OIG Position We concur with the actions taken by FSIS, AMS, ARS, APHIS and the 
Forest Service to assess the risk associated with biological agents and 
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determine the commensurate biosafety and biosecurity level for each agent. 
We agree with the actions of the Forest Service to conduct physical security 
risk assessments at their facilities. However, to reach management decision 
for this recommendation, the Forest Service needs to provide us with a 
timeframe for the completion of the reviews. 
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Section 2. Laboratory Security 


Finding 3 Laboratories Can Enhance Their Physical Security With 
Additional Funding Provided by Congress 





Not all USDA laboratories were adequately secured against intrusion by 
unauthorized personnel. Few risk assessments had been made prior to or 
immediately after September 11, leaving laboratory and agency officials 
either unaware of the adequacy of security, skeptical of the recommended 
upgrades, or uncertain how to fund them. We concluded that biological 
agents stored at some of the less secure laboratories were vulnerable to theft 
and misuse. Subsequent congressional funding for homeland security 
activities has provided the Department with additional means to enhance 
laboratory security at its facilities. 


Officials at only 12 of the 91 sites we visited believed security was 
inadequate at their sites. In 11 cases, the officials pointed out the absence of 
alarm systems, security fences, or surveillance cameras. However, we 
concluded from our observations that security needs were more widespread 
and that improvements were needed at 41 of the 91 sites. Fifteen sites in our 
sample had already experienced break-ins and vandalism prior to our visits. 
Unauthorized persons had entered laboratories to use or steal computers and 
other equipment, or to release laboratory animals. At one ARS laboratory, 
the intruder destroyed an experiment in progress by turning the power off. 
Five break-ins involved BSL-2 laboratories, and one of these five break-ins 
occurred after September 11. Although officials at the five BSL-2 
laboratories that experienced break-ins did not express any concerns that 
biological material could have been removed, only two of the laboratories 
had current inventories that could be used to make such a determination. (As 
stated earlier, we did not find anthrax being used or stored in any location not 
designated for it.) 


Agency managers and officials at most of the laboratories we visited agreed 
on the need to immediately upgrade the physical security at the facilities to 
help reduce the risk that ongoing research could be destroyed or otherwise 
adversely affected by terrorism or vandalism and ensure that hazardous 
organisms are not released. Some laboratory directors and other staff were 
aware of security needs and emphasized the unmet security upgrades 
identified in security surveys. For example, the security survey conducted at 
several collocated ARS’ and APHIS’ laboratories recommended perimeter 
fencing. However, the higher biosafety level laboratories for both agencies 
remained unfenced during our fieldwork due to funding constraints while the 
lower level laboratories were fenced. Additionally, some field laboratories 
that were not near their central facilities, such as the laboratory located in a 
strip mall, appeared to be at most risk and should be considered for 
consolidation with more secure facilities. With funds now available for 
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security upgrades, the Department should ensure that its most urgent needs 
(1.e., laboratories with moderate and high risk biological agents) are met first. 


Based on our interviews with Department and agency officials, we could not 
identify any one individual at the Department level who was assigned the 
responsibility for monitoring or reviewing the physical security at these 
facilities to ensure it was adequate. 


We did note, however, that the Department’s Office of Procurement and 
Property Management (OPPM) provided technical assistance in awarding the 
security assessment contract to Sandia National Laboratories on behalf of 
ARS and APHIS. Under the terms of the contract, Sandia is performing 
risk-based evaluations of USDA’s seven most sensitive laboratories based on 
the most probable threat scenarios. OPPM is also managing an effort (using 
both in-house and contract staff) to survey an additional 90 ARS laboratories 
and 15 APHIS laboratories. 


None of the five BSL-2 laboratories that experienced break-ins have had 
subsequent intrusions after strengthening their security. In one case, that of 
laboratory D in our sample, security improvements included a 10-foot-high 
chain link fence with razor wire established around the perimeter of the 
compound. This unit has been subject to threats from animal rights groups, 
but since implementing its security upgrades, it has not experienced a 
subsequent intrusion. 


Physical security at the one site we visited with a BSL-3 laboratory was 
clearly not commensurate with the risk posed by the biological agents stored 
in the laboratory. Our review of laboratory B disclosed that there were no 
security alarms, no regular police patrols in the area, and no alarms to alert 
facility management of an equipment problem during off-hours. 
Furthermore, the facility was adjacent to the interstate highway with an exit 
ramp beside the property, and the microwave security system was disabled 
because highway traffic set off the alarm. The perimeter fence was only 
about 8 feet high with no additional barner at the top, and one of the outer 
doors to the livestock building was broken and held shut with a bungee cord. 


The Department’s new policies and procedures set forth a strategy for 
providing physical security at each of USDA’s laboratories with high risk or 
high consequence pathogens. The policies define the areas needing 
security—e.g., perimeters, buildings, laboratories—and specify the security 
devices—e.g., barriers, security guards, key cards—that should be installed in 
each area. 
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Recommendation 
No. 4 


Agency 
Responses 


OIG Position 


The practices outlined in the Department’s policies and procedures appear to 
be thorough and stringent and will clearly require some investment of 
resources. On January 10, 2002, President Bush signed the Defense 
Appropriations Act, which included $328 million for USDA for security 
upgrades and other activities in response to terrorist attacks. In anticipation 
of this funding, the Secretary asked each agency to prepare a plan for 
allocating the funds. The plans were submitted to the USDA Homeland 
Security Council to ensure funding of the most critical needs. We 
recommended priority funding for laboratory security, based on the 
observations we had made at field sites. The Act emphasizes protection of 
the Nation’s food supply by designating $119 million for APHIS, 
$113 million for ARS, and $15 million for FSIS. As noted earlier, ARS 
operates most of the laboratories within USDA. The remaining $80 million 
in appropriations is designated for other USDA homeland security priorities. 
These additional funds should help USDA attain the appropriate level of 
security needed to keep biological agents from falling into the wrong hands. 


Evaluate the results of security reviews conducted at two of the Department’s 
BSL-3 laboratories (laboratories E and F) and begin implementing corrective 
actions related to security issues immediately. Arrange for security reviews 
of other USDA laboratories, starting with level-3 facilities. 


ARS stated that it has increased security at laboratory E by adding armed 
security guards and requesting routine Coast Guard boat patrols. ARS has 
also contracted through OPPM to review security at all locations not covered 
by the Sandia project. The agency expects 34 sites to be completed by April 
and the rest by September. Security guards and patrols have also been 
deployed by APHIS at laboratory F, and security reviews have been 
completed at other APHIS laboratories and corrective actions began shortly 
after September 11. AMS stated it does not handle or store BSL-3 or high 
consequence materials. AMS feels the current security and safety measures 
in place are sufficient for materials handles and stored. Although the Forest 
Service stated that they have no BSL biological agents, physical risk 
assessments are being conducted or have been completed at most Forest 
Service facilities. FSIS, as part of its accreditation under the International 
Organization for Standardization, implemented safeguards to enhance 
security at its laboratories. FSIS also established a laboratory security team 
to identify and evaluate security issues. Also, FSIS stated that its Quality 
Assurance Division conducts unannounced audits at each of its laboratories. 


The agencies’ responses addressed all of the security issues cited. However, 
to reach management decision for this recommendation, the Forest Service 
needs to provide us with a timeframe for the completion of the reviews. 
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Recommendation 
No. 5 


Agency 
Response 


OIG Position 


Recommendation 
No. 6 


Agency 
Response 


OIG Position 


Recommendation 
No. 7 


Agency 
Response 


OIG Position 


Immediately assesses the feasibility of continuing current research and 
diagnostic activities at the facilities located in a strip mall. 


With the homeland security funding provided by Congress, APHIS will 
relocate the strip mall facility to a new location where it will pose a lesser 
risk to the public and where it can be more adequately secured against 
unauthorized entry. APHIS estimates that it will take 3-5 years to complete 
permanent structures for the laboratory at the new location. However, since 
the audit, all pathogens of consequence have been removed from the strip 
mall facility to locked, controlled access freezers on the main laboratory 
campus. 


We can reach management decision for this recommendation based on the 
action taken and planned by APHIS. 


Take immediate action to correct the deficiencies at laboratory B, including 
the problems in inventory of biological agents, containment procedures, and 
physical security. 


ARS is in the process of correcting the deficiencies at laboratory B. Officials 
said additional steps will be taken in accordance with the recommendations 
made by Sandia National Laboratories and will depend on Defense 
Appropriation Act funds. 


We concur with this action. However, to reach management decision for this 
recommendation, ARS need to provide timeframes for correcting the 
deficiencies at laboratory B. 


Propose to the Secretary that one individual at the Department level be 
responsible for monitoring and reviewing the physical security at USDA 
laboratories to ensure the security 1s adequate. 


The Deputy Assistant Secretary for Administration has pointed to the work of 
OPPM as evidence of current Department-level involvement in the 
biosecurity needs of the agencies. The Deputy Assistant Secretary notes that 
there is an ongoing movement towards centralizing physical security 
oversight over the laboratories at OPPM. 


Although the Deputy Assistant Secretary for Administration indicates that 
there is ongoing movement towards centralizing physical security oversight 
over laboratories at OPPM, to reach management decision for this 


a 
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recommendation, we need a decision from the Department identifying the 
individual or position at the Department level responsible for monitoring the 
physical security at USDA laboratories. 














Finding 4 Rees Did Not Adequately Control Access to Biological 
gents 


Officials did not always restrict access to their laboratories or to the 
biological agents stored in the laboratories. At many laboratories, scientists 
and researchers not associated with USDA research and diagnostic activities 
could enter the laboratories and storage units where biological agents were 
accessible. Some of these scientists and researchers were non-US citizens. 
In some cases, laboratories had not received any post-September 11 
instructions regarding access by visiting researchers or others with keys to the 
laboratories. | With unrestricted access, unauthorized personnel with 
knowledge of a laboratory’s inventory could remove a biological agent and 
place it in a terrorist’s hands long before the theft was discovered. 


All 12 of the laboratory officials who believed security was inadequate at 
their sites were specifically concerned that access was not restricted and that 
background checks were not adequately performed on visiting scientists and 
others. 


Background Checks Were Not Adequately Performed 


During our discussions and visits with agency officials at both the 
Headquarters level and at the field laboratories, we noted that a security 
background check was not completed for all personnel who had access to 
biological agents. Employees had been given access to these materials 
pending the background check, but because the Department had a 
substantial backlog of uncompleted background checks, clearance came 
months after access was allowed. As a result, agencies could only restrict 
new employees’ access to certain laboratories, escorted or otherwise, or 
find other jobs for them to do until the checks were completed. Without 
adequate background checks, the risk that someone may vandalize or 
destroy ongoing research or laboratory facilities or remove hazardous 
organisms is increased. 


A majority of the sites we visited have foreign scientists or students 
working in the laboratories, and most of these visiting foreigners have 
access to biological material. However, about 80 percent of these sites did 
not do background checks on the visitors. Visiting research scientists and 
other skilled technicians may be allowed access to the facilities (and the 
biological agents) based on their prior working experience with facility 
officials. Furthermore, agency officials have stated that there is no 
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Department requirement for background checks; consequently, we are 
uncertain of the adequacy of the checks performed by those few sites that 
claim to have done them. For example, an official at one site said he 
considered a visa an adequate background check for a visiting scientist. 


The director of the Office of Crisis Planning and Management (OCPM), 
which is responsible for processing background checks within the 
Department, said that he had added contract staff to his office to complete 
the backlog of over 600 requests for clearance. He said that prior to 
September 11, the process of completing a background check could take 
up to 2 years. His office is determined to trim that to about 75 days. 
Requests are received, reviewed, and submitted to the Office of Personnel 
Management within 2 weeks. The Office of Personnel Management 
returns the clearances in 30 days, and OCPM takes another 30 days to 
finish the processing. The director also said that his office does not 
perform checks on foreign visitors because their records are not available. 


Department representatives said that OCPM is working closely with ARS 
and APHIS to obtain the security clearances and suitability determinations 
needed for laboratory personnel. They noted, however, that background 
investigations are a continuing, labor-intensive process because of the 
need to clear new hires. They said that with the renewed interest 
Government-wide in personnel security, they anticipated new surges of 
background investigation requests in the future from the laboratories and 
throughout the Department. 


Physical Access Was Not Always Restricted 


Officials also needed to restrict access to their BSL-2 laboratories. For 
example, the ARS research site which houses laboratory A provided keys 
to some of its laboratories to a contractor to perform custodial service after 
hours. Because the issue of custodian access to the laboratories was not 
part of our scope, we do not know how widespread this practice is, and we 
do not know what kind of background checks, if any, are performed on 
custodians. At laboratory B, students, professors, and laboratory assistants 
not associated with ARS research or diagnostic activity could obtain the 
key to the BSL-2 laboratory and use it even when authorized personnel 
were not present. A laboratory official also noted that students who had 
graduated may not have always turned in their keys. The locks had been 
last changed about 5 years before the audit. 


An official at laboratory B= stated that the facility needed many 
improvements to assist in preventing unauthorized access and intentional 
release of biological agents; however, no action had been initiated or 
planned by the agency at the time of our review. An official at laboratory 
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Recommendation 
No. 8 


Agency 
Responses 


G in our sample also expressed a need for greater security and controlled 
access. He said that although the gates to this BSL-3 laboratory were 
guarded by day and the buildings locked by night, he questioned the 
competence of the contract guards, and he believed the unattended 
buildings were vulnerable. A BSL-2 freezer in the laboratory was never 
locked, and the gate guards seldom required identification or passes of any 
kind to enter. The agency did not require background checks on the 
scientists working at this laboratory, and none were performed. The 
laboratory relied on the integrity of the scientists, none of whom wore 
identification badges in or around the compound. 


Although we found that some facilities maintain an inventory list of 
biological agents being stored, the facilities did not always require the 
staff to record the removal of any samples from the inventory or their 
return to inventory. Also, at some locations we visited, employees were 
not required to wear picture identification or any other type of distinctive 
badge, making it more difficult to determine who was authorized to be in 
the laboratory. 


We concluded that agencies should review their security procedures to ensure 
that access to high-level biological agents is controlled and that unauthorized 
removal of the agents does not occur. We also concluded that the agencies 
need to determine the necessity for background checks and _ security 
clearances for personnel with access to high-level biological agents and to 
establish a protocol for approving authorized access to such agents. The 
Department’s new policies and procedures also provide for such protocols. 
The policies and procedures identify the suitability requirements that will 
determine which positions require clearance, and they outline escort 
procedures for all personnel that do not have clearance. 


We also concluded that agencies need to work with the Department to reduce 
the backlog of security clearances. 


Immediately review security procedures to ensure access to high consequence 
biological agents is controlled and limited to authorized purposes. Institute 
management controls to ensure that unauthorized removal does not occur by 
restricting access to facilities and laboratories handling or storing such high 
consequence biological agents only to personnel with authorized access and 
with the appropriate identification and requiring specific tracking of any 
removal and return of samples of high-level biological agents. 


ARS participated in the Department’s task force to develop policies and 
procedures for laboratories containing BSL-3 agents and other high 
consequence pathogens. The new policies and procedures establish generic 


 ————— 
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OIG Position 


Recommendation 
No. 9 


Agency 
Responses 


OIG Position 


requirements and protocols for physical security, personnel security, and 
emergency response plans and are in the process of being implemented at the 
five BSL-3 laboratories. ARS will implement the policies and procedures at 
the other laboratories once the risk assessment is completed to identify the 
agents and locations. APHIS laboratories have already implemented 
procedures restricting access to pathogens of consequence. 


Officials of AMS and the Forest Service stated they do not need to institute 
any controls because they do not use or store high consequence biological 
agents. FSIS formed a team of laboratory representatives in September 2001 
to assess laboratory operations, and based on the team’s critique, it has 
subsequently enhanced existing security plans. 


We concur with the actions of APHIS and ARS to limit access to high 
consequence biological agents and with the actions of FSIS to enhance its 
existing security plans. However, in order to reach management decision on 
this recommendation, the Department needs to define high consequence 
biological agents. Based on this definition, each agency will need to 
determine the appropriate security procedures if it handles or stores any high 
consequence biological agent at its facilities. 


Immediately determine the necessity for background checks and security 
clearances for those personnel having access to high consequence biological 
agents, particularly those with access to level-3 laboratories. Establish a 
protocol for approving authorized access to such materials. Also, work with 
the Department to reduce the backlog of security clearances. 


ARS has identified 229 positions at BSL-3 laboratories requiring background 
checks. The agency has requested 180-day temporary clearances for these 
employees while the background checks are underway. APHIS noted that it 
has identified all the individuals with access to high consequence biological 
agents who require full-fledged background investigations. Officials from 
AMS, FSIS, and the Forest Service said they do not use high consequence 
biological agents and therefore do not need to establish protocols for 
approving access. 


The backlog of security clearances has been cleared at USDA. The Office of 
Personnel Management (OPM) has yet to respond to about 400 of the 
clearances that were forwarded to it for final approval. OPM has estimated 
that the 229 background checks requested by ARS will take up to 6 months to 
complete. 


We concur with the actions of OCPM to reduce the backlog of background 
checks. We also concur with the actions of ARS and APHIS to identify 
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positions requiring background checks. However, in order to reach 
management decision on this recommendation, the Department needs to 
define what constitutes a high consequence biological agent. Based on this 
definition, each agency will need to implement the appropriate personnel 
security procedures if it handles or stores any high consequence biological 
agent at its facilities. 


Finding 5 Laboratories Had No Procedures to Report Unauthorized Access 


The Department has no consistent policy for reporting incidents of 
unauthorized intrusion to their agency headquarters. Although laboratories 
were required to report break-ins to several Federal agencies responsible for 
security and criminal investigation, there was no written requirement to 
report these incidents to agency headquarters. Generally the low-nsk 
laboratories were unaware of any reporting requirements, and only informed 
local police when a break-in occurred. Without specific reporting 
requirements, agency officials cannot manage the security of their laboratory 
networks and cannot know when security levels are inadequate. 


Our review found that responsibilities within the Department for handling 
biosecurity issues, including response to accidents and attacks, are not 
centralized. 


There are at least four organizations that appear to have overlapping 
responsibilities; however, there is little coordination or communication 
among them. Although the Office of Crisis Planning and Management 
maintained that all incidences at laboratories should be reported to it, we 
found that personnel at the field sites were often not aware of this reporting 
requirement. In fact, during a visit to one facility, facility officials were also 
unaware that the Office of Inspector General should be contacted in the event 
of vandalism or potentially unauthorized access to the facility. We also 
found that most laboratories have independently established some type of 
coordination protocols with local law enforcement agencies to respond to 
security issues. However, in addition to this coordination, agencies need to 
ensure that field laboratories also report and coordinate such incidences to the 
agencies’ Headquarters-level officials and to the appropriate Department 
officials. 


The Department’s new policies and procedures provide a biosecurity incident 
response plan. The plan calls for the immediate notification of the agency’s 
incident response chief, who will in turn notify the other responsible offices, 
notably the Office of Inspector General, the Federal Protective Service, and 
the local police. In the event of a biocontainment breach, the agency will 
also notify APHIS and the Office of Crisis Planning and Management. 
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Recommendation 
No. 10 


Agency 
Responses 


OIG Position 


Immediately issue a notice to all laboratory facilities with high consequence 
biological agents that they are to report any improprieties or vandalism 
involving such materials to the agency’s Headquarters office, which will in 
turn notify the Office of Inspector General and the other relevant offices. 


ARS and APHIS both referred to the Department policies and procedures, 
which call for reporting intrusions at laboratories. ARS further responded 
that it has communicated repeatedly with its laboratories, orally and through 
e-mail, since September 2001, providing all ARS employees with guidance 
on reporting suspicious activity while on Government premises. APHIS also 
commented that its primary BSL-3 laboratories have developed an incident 
response plan and that its laboratories have been provided written guidance 
on reporting incidents and suspicious activities. The Deputy Assistant 
Secretary for Administration proposed that OPPM be among the points to 
which notification of unauthorized access is reported. 


Officials from AMS, FSIS, and the Forest Service said they do not use high- 
level biological agents and, therefore, the recommendation was _ not 
applicable. 


In order to reach management decision on this recommendation, we need 
additional information from AMS, FSIS, and the Forest Service as to any 
instructions or guidance provided to their staff and facilities on reporting 
improprieties, vandalism, or any unauthorized intrusion. Because of the 
heightened sensitivity since September 11, proper and coordinated handling 
of such incidents by all staff is critical. Also, we need specific plans and 
timeframe for implementing any action by the Department. 
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scope and Methodology 


Our audit effort was conducted at USDA facilities across the United States. 
We reviewed the Department’s policies and regulations over the control of 
inventory, containment, and physical security. Our review was conducted 
from April 2001 through February 2002 and covered activities during this 
period. 


We initiated this assignment as an audit survey to determine whether controls 
were in place to prevent any accidental or clandestine release of biological 
agents. Our survey, which initially included visits to 10 USDA laboratories 
across the country, disclosed that the Department had no policies and 
procedures in place for facilities to follow in order to prevent the release of 
biological agents. Therefore, we focused on the individual agencies’ 
management of the security and safety of biological agents. 


The terrorist attacks of September 11, which occurred during the course of 
our audit, did not change our objectives, but induced us to consider more 
carefully the possibility of unauthorized entry to the laboratories to gain 
access to biological agents capable of harming the food supply. Our audit 
consequently came to emphasize the security of these agents. 


USDA operates approximately 336 laboratories. Of this total, ARS operates 
243; the Forest Service, 77; APHIS, 4; FSIS, 4; and AMS, 8. These 
laboratories carry out research or diagnostic testing at 194 locations 
throughout the country. 


We visited a total of 124 judgmentally selected laboratories at 91 sites.* 
Because of the sensitive nature of biosecurity at these laboratories, we have 
refrained in this report from giving either the laboratories’ names or their 
locations. A separate document containing this information will be presented 
to Department managers for their use in implementing corrective action. 


During the first phase of our review, we visited 10 laboratories at 4 sites that 
were considered the highest risk and stored or used the largest number of 
biological agents. During the second phase, we visited 114 laboratories at 
87 sites that were selected based on their proximity to our audit offices. The 
total sample included laboratories at 69 ARS sites, 17 FS sites, 3 FSIS sites, 
3 APHIS sites, and 1 AMS site.’ Of the 91 sites, 4 were classified as BSL-3, 


8 The exact number of sites will vary, depending on the source of the count and the definition of “site.” 
° Some sites house laboratories from two different agencies. Consequently the number of sites assigned to each of the 


agencies will in the aggregate exceed the total number of sites visited. 
Saher ne 
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21 were classified as BSL-2, 14 were classified as BSL-1, and 55 were 
unclassified or were not aware of their BSL.'” 


We also reviewed the biosafety level of one AMS laboratory at a site not 
included in our sample. We became aware during our audit that agency 
managers for this laboratory did not know the biosafety classification of the 
site. An auditor at the site for another purpose verified this report. 


Our audit was performed in accordance with generally accepted government 
auditing standards. To accomplish the audit objectives, we performed the 
following steps: 


e Reviewed applicable laws, regulations, and guidance concerning bio- 
logical agents, 

e Reviewed USDA policies, procedures, and administrative controls con- 
cerning biological agents, 

e Interviewed officials of the USDA Office of Crisis Planning and 
Management, the USDA Biosafety Committee, the USDA Biosecurity 
Committee, the Safety and Health Management Division of USDA’s 
Office of Human Resources, and the Office of Procurement and Property 
Management, 

e Reviewed agency policies and procedures regarding the control of bio- 
logical agents, 

e Visited laboratories selected from all levels of biosafety classification, 
and 

e Interviewed laboratory and agency officials responsible for handling, 
storing, and disposing of biological agents. 


'0 T aboratories that do not use or store biological agents do not have an assigned biosafety classification. Furthermore, sites 
may house several laboratories, each with a different biosafety classification. For purposes of this review, if a site housed 


multiple laboratories, we assigned the site the highest biosafety classification that any one of the laboratories at the site had. 
NN ——— 
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Exhibit A 





Response to the Draft Report From the Deputy Assistant Secretary for Administration 


USDA 
a Tal 


Agriculture 


Office of the 
Assistant Secretary 


for Administration Kiarchel 5] 2002 
Memorandum 
1400 Independence 
Avenue SW 
. To: Joyce Fleischman 
ashington, DC ; 
Bee ot 03 Acting Inspector ences Ny 


From: John S Khe EE 
Deputy Assjetant Secre or Administration 


Ref: 50099A3-At 





Subject: Oversight and Security of Biological Agents at Laboratories 
Operated by the U.S. Department of Agriculture 


Overall, we conclude that draft report serves a constructive purpose by helping 
keep the momentum underway to tighten security at USDA laboratories. 
Appropniately, the principal responders to this report will be those agencies with 
ownership of the laboratories. Departmental Administration (DA) is playing a role 
in assisting those agencies in strengthening the physical security and personnel 
security at these facilities. We therefore, appreciate the opportunity to comment 
on the draft report. 


The report is wnitten in general terms and is lacking the degree of specificity that 
would make it an action document. In this particular case, however, we agree that 
it is appropriate. The sensitivity of the subject matter and the possible uses to 
which malicious parties could put more specific information justifies the broad- 
brush approach employed. Implicit in this reasoning is a requirement that more 
specific information developed by the labs, the parent agencies and your office 
needs to be protected from public release. Perhaps that message should be explicit 
in the final report. 


Finding 1 speaks to the need to speed the development of Department-wide 
Policies and Procedures for laboratories. Reference is made to the Committee 
developing these protocols for the labs working on the most hazardous pathogens. 
Departmental and Federal regulations are being implemented on personnel 
security, physical security, as well as access to, and custody of, high consequence 
pathogens within the labs. We believe that your final report should also 
acknowledge, for the record, that the Sandia Labs project has served to provide a 
separate, objective, expert review that serves to validate and complement the work 
of the P&P Committee. The lab directors, the P&P committee, and Sandia 


AN EQUAL OPPORTUNITY EMPLOYER 
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personnel met on February 21, 2002 and are currently blending the best elements 
of both efforts. 


Finding 2 calls for a consolidated database of biological agents. The report is 
vague as to what a central system should look like. DA does not criticize this level 
of generality as it is warranted, not just for security, but also out of recognition that 
maintaining an inventory of living organic materials that grow, pass through other 
living things, and expire is not at all the same as keeping an inventory of stable, 
inorganic materials. As with other details on lab security, such an inventory likely 
warrants some form of protection against unauthorized release to the public. 


We would like to see Finding 3 acknowledge the ongoing security surveys under 
DA’s auspices. DA’s Office of Procurement and Property Management (OPPM) 
entered into a reimbursable agreement with the Department of Energy to employ 
Sandia National Laboratories to perform risk-based evaluations of our seven most 
sensitive labs based upon the most probable threat scenarios. This contract was 
awarded on behalf of ARS and APHIS, but DA serves as Contracting Officer’s 
Technical Representative. 


In addition to the seven bio-safety level 3 laboratories addressed in this effort, 
OPPM is also managing an effort (using in-house and contract staff) to survey an 
additional 90 ARS labs and 15 APHIS labs. Therefore, in keeping with your 
Recommendation 7, there is an ongoing movement towards centralizing physical 
security oversight over our laboratories at OPPM. Given the positive response 
thus far encountered within ARS and APHIS, we anticipate that our assistance will 
be welcomed by other agencies with laboratory assets. In this regard, we propose 
that OPPM be among the points to which notification of unauthorized access is 
reported per Recommendation 10. 


The report, in finding 4, addresses the importance of conducting background 
investigations on lab personnel so that the Department can reasonably deem them 
trustworthy either for holding positions of public trust or for access to national 
security information. DA’s Office of Crisis Planning and Management (OCPM) 
manages the Department’s revived Personnel Security Program and is working 
hand-in-hand with ARS and APHIS to obtain the security clearances and 
suitability determinations needed for lab personnel holding positions of public 
trust or requiring access to national security information. 


We suggest some elaboration on this topic. While the old backlog has been 
eliminated, given the renewed interest in personnel security generally, we 
anticipate new surges of background investigation requests in the future from the 
labs, and throughout the Department. This will be a continuing, labor-intensive 
requirement because of the need to clear new hires and the obligation to re- 
investigate individuals according to an established schedule. 


USDA/OIG-Audit No. 50099-13-At | 26 


i 
ibesis “were se we Tle fo eceiy ap tant Gea 


le ME Whee: wi! i ee tine COleceweng Wo 


shifts hed ho 


\etinwe eri i a2 :! ota lees & xl wine S gaitn 
att Ly te ) \ ? we} “'® ace <i Le OIGAT 


1D Dameware : i 7 vitor a penile 
ear ‘ ie Jord » kata ap ‘vil 
"mkt vane eA Sal weT SutEg 

mi . =“ eIT io cru? en Gere 


’ 
=| 


om of ob) biog o'W 
‘ Withlea Oe AD a wus 2° AO 


° i dora 2 ots? 4 olnd ae 
ly fr mole e iwiaiotg.| ancitads ely 


| i wh foqu heey! ade org 
TA iw } ' 3 om below we 
rer wah ‘esuariooT 


| vistes-cif aove: off of potest al 


) TRS wo onary Gl ef Ge) 

EVLA 2° bes ecal FILA etarili 

HOR” we ot ven? ite henna 
rode etal two tevo fy! Virwose 
oH Cal tA Gag € fiitw beara wea asayi 
. “) @ tvperegs roilhy vd tee MT wi 
‘ Uyill 3} edi fon ie gross a ) fell 
breton te wry 
’ ae ; a: icon ] 
i% ; f reo OL a ’ i Lee 
' pts ot rate ‘ 

+e ‘] goiter f 
- io hl? ARoyTerd $4 espe 
sal? uniéo at ZirS“ A bas CRA iw beed-c-dead 
yore) de, ra) bobetn eanpamamtied 7 os 
aucwolr v1 Dee ‘anes 6) eee BAe to jars 
rullf” -y qo! ct as pomeedals sexe Geepee JW 
winds!) of lervela! beweret of) oe Durinls 
WPS UIT Sf UOWMA7nq > ey ‘7 Plage. te 
t ti tetany ait) urortgerrul® Lane actel 
hw oh wee tomy OF bean ent lo summed SEE 
bij? lovie’ aac mmo) gruintoos eleaubrribnt eg ipeve 


= = — a 
a mol wit j i 
- > 2 ae 
- eS 

re Se a 





Page 3 of 3 


While our present target of 75 days is a dramatic improvement from the two-year 
timeframe correctly noted for years past, the target is based on the assumption that 
all requests are for the more costly, expedited process, and that the Office of 
Personnel Management (OPM) can continue to provide that expedited service on 
time. We believe that Recommendation 9 will be met through the special 
procedures that have been established to assure that all lab personnel with access 
to high consequence pathogens and/or national security information will have 
appropriate clearances or suitability determinations. For incumbent lab personnel 
who may need an initial investigation or a re-investigation, a two-step process has 
been set up to afford a rapid preliminary check followed by the more lengthy 
conventional procedure. 


Please contact me if you would like elaboration on the foregoing. 
CG: Assistant Secretary Gallegos 


Russ Ashworth 
Cliff Oliver 
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USDA/OIG-Audit No. 50099-13-At pa 


nen Noo ) 7 ae yM Sit » e/ eee <7 De epee Aa wa 
' yrintte w (oad as Peer 2 a ae, To Lemaips ciPvsossp o*eatt “unt 
Soa) bent eee Dati leet ,y fare cca: aa a age comaacgery Tha 


tise) epre pack are af geegi (>) hestiganlt jancown. - : : 
2 wi) (yo A i ae he Aa =e tes eeipg eH ait , 
Y oO Ne (et ern ' (hare tie? ca! Gye erusteogsy - 
: rr Gp al ang Tay of ee perrrs ay iit ap 
Tay “awe sal “ho v' sontwulp MRP VY erie 
f lig weg eve lative om Cem ved cle 
jfie i yer iv > Meer a I le G4 Qe 106 ue) 
nivVLo ead LoNtinevnos 
giiing 


7 














i 8% uy Td aire Ti “= 


“*>* ) 4 i 7rmReeA “oN 
J fer ean 
rev ilC) Tink 


Exhibit B 





Response to the Draft Report From the Agricultural Research Service 


DEPARTMENT OF AGRICULTURE 
OFFICE OF THE SECRETARY 
WASHINGTON, D.C. 20250 





MAR 15 2002 

SUBJECT: Oversight and Secuntty of Biological Agents at Laboratories Operated by the 
U.S. Department of Agriculture 

ATTN OF: = 50099-13-AT 


TO: Joyce N. Fleischman 
Acting Inspector General 
Office of Inspector General 






FROM: Joseph J. Jen 
Under Secretary 
Research, E 


We have received and reviewed the Draft Audit Report titled as above, Report No. 50099-13-AT, 
March 2002. ARS had provided comments and information on actions taken in the responses to 
the September 24, 2001, and the December 10, 2001, Management Alerts, and the response to 
your letter dated January 22, 2002. Since that time, ARS has taken further actions that are 
relative to the concerns and recommendations raised in the Draft Report. ARS responds as 
follows: 


° Response to Recommendation No. 1. 


...Hasten the implementation of the policies and procedures being prepared by the Department's 
biosecurity task force. 


As reported in the REE response to the OIG January 22, 2002, letter, an ARS/APHIS working 
group submitted a draft Implementation Plan for BSL-3 facilities on January 16, 2002, to 
implement the provisions of the P&P on Biosafety. Subsequently, the Secretary’s Office has 
directed that a working group be formed to harmonize the P&P with the security assessment 
made by Sandia National Laboratories. That working group anticipates completing its work by 
the end of March. Once that activity is completed, the draft Implementation Plan will be revised 
as needed. The ARS Office of Homeland Security (OHS) will continue to coordinate efforts for 
the protection of ARS physical and biological assets. 


AN EQUAL OPPORTUNITY EMPLOYER 
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° Response to Recommendation No. 2. 


... Direct all agencies to instruct all USDA laboratories to immediately compile a comprehensive 
listing of biological agents..... 


ARS completed data collection of a National Pathogen Inventory (NPI) on January 11, 2002. 
Review, and where needed correction, of the more than 5,000 individual entries was done to 
ensure consistency of nomenclature, correct misspelled pathogen names, eliminate duplicates 
within a reporting unit, and permit accurate retrieval of pathogen information. This activity was 
completed by February 22, 2002. Currently, the draft NPI has reports from 234 Research 
Management Units for which 137 filed positive reports for pathogens and 97 filed negative 
reports. NOTE: the number of Units at any point in time may vary as Units are created, 
eliminated, or consolidated. On March 4, 2002, all Units were advised to review and verify the 
corrected responses for their unit. Negative responses also require validation. Once the current 
validation phase is completed, end of March, the NPI will be removed from the web, but will 
remain available to managers at the headquarters level. All steps in developing, correcting, and 
validating the NPI were conducted using a firewall and encrypted Internet transmission. 


° Response to Recommendation No. 3. 


...Based on the inventory of biological agents for each facility, each agency should immediately 
assess the risk associated with such biological agents and determine the commensurate biosafety 
and biosecurity level for such agents. 


The ARS Biosafety Officer has assigned biosafety levels to all 2,365 individual agents in the 
NPI. Appropriate security measures will be implemented pending the completion of activities 
described under the response to Recommendations No. 4 and No. 8. Oversight and coordination 
of facility security for ARS, APHIS, FSIS, FS, and AMS will continue to be provided by the 
Work Group on Homeland Security, Sub-Council on Protecting USDA Facilities and Other 
Infrastructure which was appointed by the Under Secretaries of REE and NRE on January 7, 
2002. 


° Response to Recommendation No. 4. 


...Evaluate the results of security reviews conducted at two of the Departments BSL-3 
laboratories (laboratories E and F) and begin implementing corrective actions related to 
security issues immediately. Arrange for security reviews of other USDA laboratories, starting 
with level-3 facilities. 


The USDA contracted review of the five BSL-3 facilities was completed by Sandia National 
Laboratories in December 2001. A draft report was provided to the Department in January 2002. 
Complete implementation of the Sandia recommendations will first require the harmonization of 
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the draft report with the Biosecurity P&P and a Phase II contract with Sandia. The response to 
the January 22, 2002, letter described the ARS initiated contract through the USDA Office of 
Procurement and Property Management (OPPM) to conduct risk assessments of at all ARS 
locations not covered by the Sandia or other risk assessment reports. Twenty-two location 
assessments have been completed, 12 other locations will be visited between March and April 
2002, and the remaining locations will be visited between May and September 2002. 

Finding 3 in the Draft Report describes the additional resources provided in the Defense 
Appropniations Act to fund ARS security upgrades. Plans for the use of these funds have been 
provided to the Department. Release of these funds will be necessary to implement any 
additional security measures. 

. Response to Recommendation No. 5. 

Recommendation No. 5 concerns APHIS, not ARS. 


. Response to Recommendation No. 6. 


... Take immediate action to correct the deficiencies at laboratory B, including the problems in 
inventory of biological agents, containment procedures, and physical security. 


Steps taken to correct deficiencies were described in the response to the January 22, 2002 letter. 
Additional steps will be accomplished in Phase II of the and implementation of the Sandia 
recommendations and will depend on the Defense Appropmiations Act funds. 

. Response to Recommendation No. 7. 

Recommendation No. 7 calls for action on the part of the Secretary. 


. Response to Recommendation No. 8. 


... Immediately review security procedures to ensure access to high consequence biological 
agents is controlled... 


No additional comments. 
: Response to Recommendation No. 9. 
... Immediately determine the necessity for background checks and security clearances for those 


personnel having access to high-level biological agents, particularly those with access to level-3 
laboratories... 


Sr 
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ARS has completed its initial assessment of mission critical ARS employees having access to 
facilities containing BSL-3 pathogens. To date, 48 positions have been identified as requiring 
Personnel Suitability Level-3 (PSL-3) background checks, as described in the Biosecurity P&P, 
and 181 positions at PSL-2. It is estimated that these background checks from OPM may require 
up to 6 months to complete at a cost of $575,000. While these background checks are being 
conducted and in order to continue critical research programs, ARS has requested 180 day 
temporary clearances from the Department. The ARS OHS and ARS Human Resources Division 


are implementing new procedures to speed up and track security clearances and background 
checks. 
° Response to Recommendation No. 10. 


.. Immediately issue a notice to all laboratory facilities with high-level biological agents that 
they are to report any improprieties or vandalism involving such materials... 


No additional comments. 
We would be pleased to keep you apprized of progress in these efforts. If you have any questions 


or concerns, please contact Michael Ruff, the Director of the ARS Office of Homeland Security, 
(202) 720-3973. 
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Exhibit C 


Response to the Draft Report From the Animal and Plant Health Inspection Service 


USDA 
ee 


artment of 
culture 


teting and 


dlatory 
rams 


Lagat MEMORANDUM FOR THE ACTING INSPECTOR GENERAL 


ection 


| ai: Kea itl— 

ae THROUGH: Bill Hawks 

hhington, DC Under Seccrny e/a MAR 22 2002 
0 


Marketing and Regulatory Programs 


FROM: doit R. Acord 12 RAL MAR 21 ongp 


Administrator 
SUBJECT: Oversight and Security of Biological Agents at Laboratories Operated 
by the U.S. Department of Agriculture---Audit No. 50099-13-At 


This correspondence is the Animal and Plant Health Inspection Service’s (APHIS) reply to 
your draft audit report dated March 8, 2002. Each of the recommendations identified in 
OIG’s report is addressed in the enclosed comments. 


APHIS appreciates the opportunity to examine the contents of the document and submit 
our response prior to publication of the final version. 


Enclosure 


uns APHIS - Protecting American Agncutture 


An Equal Opportunity Employer 
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Recommendation 1: 


Hasten the implementation of the policies and procedures being prepared by the 
Department’s biosecurity task force. 


APHIS Response: 


Our previous response indicated that policies would be implemented at all of our 
laboratories. Our safety officials and other personnel met with counterparts in ARS in 
December. A task force was formed to develop an implementation plan with 
completion dates for milestones. 

The implementation plan for “USDA Security Policies and Procedures for Biosafety 
Level 3 Laboratories and Other Laboratories of Consequence” is still in development. 
APHIS has, however, initiated compliance with the recommendations and timelines of 
the draft document and will make necessary adjustments as the final version is 
completed. 


Recommendation 2: 


Direct all agencies to instruct all USDA laboratories to immediately compile a 
comprehensive listing of biological agents handled or stored at their respective facilities 
and to forward this listing to the agency’s headquarters for consolidation at the 
Department level. This inventory record should include all laboratories by agency, 
showing the biosafety level for each facility and a current inventory, which easily 
identifies all biological agents. Ensure the inventory record is secure and can be readily 
accessed by managers at the headquarters level. Establish a date for accomplishing this 
task. 


APHIS Response: 


Our prior reply indicated that inventories would be transmitted to agency headquarters 
by January 31, 2002. We can now report that APHIS laboratories have completed an 
inventory of all stocks of pathogens of consequence and submitted this information to 
their respective program Deputy Administrators at headquarters. This was 
accomplished by target date, and the inventory lists are maintained in password- 
protected electronic format and/or in approved security safes. Access to information is 
restricted to authorized personnel only. 


Recommendation 3: 
Based on the inventory of biological agents for each facility, each agency should 


immediately assess the risk associated with such biological agents and determine 
commensurate biosafety and biosecurity level for such agents. 
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APHIS Response: 


Our prior response stated that we would initiate risk assessment upon completion of the 
inventory process. 


Recommendation 4: 


Evaluate the results of security reviews conducted at two of the Department’s BSL-3 
laboratories (laboratories E and F) and begin implementing corrective actions related to 
security issues immediately. Arrange for security reviews of other USDA laboratories 
starting with level-3 facilities. 


APHIS Response: 


Our previous reply indicated that security guards and patrols were deployed at 
laboratory F. Physical security has been reviewed at APHIS laboratories, and corrective 
actions began shortly after September 11. Security advisories have been transmitted to 
all of our facilities by the Administrator and the MRP Business Services entity of the 
Agency. 


Recommendation 5: 


Immediately assess the feasibility of continuing current research and diagnostic 
activities at the facilities located in a strip mall. : 


APHIS Response: 


Our earlier response said homeland security funding will enable the relocation of the 
strip mall facility to another location with a reduced risk to the public and where 
unauthorized entry can be more adequately assured. Since the audit, all pathogens of 
consequence have been removed from the strip mall facility to locked, controlled access 
freezers on the main laboratory campus. Funds have already been identified, and plans 
for relocating laboratories over to the main campus are being developed. 


Recommendation 6: ARS is addressing this recommendation. 
Recommendation 7: 
Propose to the Secretary that one individual at the Department level be responsible for 


monitoring and reviewing the physical security at USDA laboratories to ensure security _ 
is adequate. 
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APHIS Response: 


The draft audit report indicates this issue is pending with USDA agencies. We reiterate 
that pathogens of consequence at all APHIS laboratories are stored in locked freezers at 
secured facilities with access limited to authorized personnel. Security clearances will 
be obtained for those individuals. 


Recommendation 8: 


Immediately review security procedures to ensure access to high consequence 
biological agents is controlled and limited to authorized purposes. Institute 
management controls to ensure unauthorized removal does not occur by restricting 
access to facilities and laboratories handling or storing such high consequence 
biological agents only to personnel with authorized access and with appropriate 
identification and requiring specific tracking on inventory records any removal and 
return of samples of high level biological agents. 


APHIS Response: 


Our former reply provided timeframes to implement USDA policies and procedures 
which require restricting access to high consequence biological agents. APHIS 
laboratories have implemented procedures restricting access to pathogens of 
consequence to authorized personnel. Appropriate background checks and security 
clearances will be made for those individuals. 


Recommendation 9: 


Immediately determine the necessity for background checks and security clearances for 
those personnel having access to high level biological agents, particularly those with 
access to level-3 laboratories. Establish a protocol for approving authorized access to 
such materials. Also, work with the Department to reduce the backlog of security 
clearances. 


APHIS Response: 


The draft report states that the backlog of security clearances has been cleared at 
USDA, but OPM had not addressed about 400 of the clearances forwarded there for 
final approval. In collaboration with USDA’s Office of Crisis Planning and 
Management, we determined that all positions at the laboratories referenced in the audit 
which have access to high level biological agents are designated, at a minimum, as 
“high risk public trust.” This is the highest level of public trust position sensitivity. 
This designation connotes full-fledged background investigation. We have identified 
those individuals, and they are completing required paperwork. These documents will 
then be processed. 
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Recommendation 10: 


Immediately issue a notice to all laboratory facilities with high level biological agents 
that they must report any improprieties or vandalism involving such materials to the 
agency’s headquarters office which will in turn notify OIG and other relevant offices. 


APHIS Response: 


Our prior reply referenced departmental policies and procedures and the requirement to 
report intrusions at laboratories. APHIS laboratories have been provided written 
guidance on reporting incidents and suspicious activities. In addition, APHIS Biosafety 
Level 3 laboratories have developed a Biosecurity Incident Response Plan. 
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Exhibit D 


Response to the Draft Report From the Food Safety and Inspection Service 


DEPARTMENT OF AGRICULTURE 
OFFICE OF THE SECRETARY 
WASHINGTON, D.C. 20250 





10: Joyce N. Fleischman 
Acting Inspector General MAR 25 2002 
FROM: Elsa A. Murano 


Under Secretary 
Food Safety 


SUBJECT: Food Safety and Inspection Services (FSIS) Response to the March 2002, 
Office of Inspector General’s (OIG) Draft Report — Oversight and Security 
of Biological Agents at Laboratories Operated by the U.S. Department of 
Agriculture, Audit Number 50099-13-At 


Thank you for the opportunity to address the issues cited in the subject audit report. I 
understand that this audit report has been distributed to the Under Secretaries for 
Marketing and Regulatory Programs, Research, Education, and Economics, Natural 
Resources and Environment, the Department, and the Assistant Secretary for 
Administration for individual responses. 


General Comments 


In the Management Alert dated December 10, 2001, you noted our continued progress in 
maintaining security controls over our laboratories. You stated: “Only a few of the 88 
sites we visited had materially increased security subsequent to September 11. An 
exception is FSIS, which has communicated information to its laboratories related to the 
concerns we raised in the September 24 management alert.” This point should be 
reinstated in your draft report. 


The report inaccurately concludes we have no plans to perform a risk assessment and 
have offered no timeframe for identifying the biosecurity measures needed at their 
respective laboratories. In fact, a risk assessment was performed by our laboratories. A 
team with representatives from the three Field Service Laboratories and the Microbial 
Outbreaks and Special Projects Laboratory was formed in September 2001. The team’s 
assessment and critique of laboratory procedures and operations have enhanced the 
existing security plans and identified opportunities for us to institute additional controls. 
The resulting security plan addresses many of the key elements in the Department of 
Justice document, "Vulnerability Assessment of Federal Facilities," dated June 28, 1995. 
The laboratories generally comply with Level III. 


AN EQUAL OPPORTUNITY EMPLOYER 
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FSIS has two laboratories in GSA facilities and one is in an USDA, ARS-owned facility. 
The three laboratories are rated at Biosafety Level Class I and follow the appropriate 
standards and guidelines. Upon receipt of biosecurity funding Support and completion of 


plans, an additional laboratory is under consideration for facility enhancements to comply 
with Biosafety Level Class D1. 


In addition, we have reviewed this draft report and discussed it with our laboratory 
managers. FSIS will continue to communicate information to all of its laboratory 


personnel regarding OIG and other concerns to maintain a heightened security and safety 
awareness. 


1. Recommendation No. lL: 


Hasten the implementation of the policies and procedures being prepared by the 
Department’s biosecurity task force. 


Agency Response: 


FSIS laboratones have recently obtained accreditation under the International 
Organization for Standardization (ISO), ISO/IEC 17025 (1999) General 
Requirements for the Competence of Testing and Calibration Laboratories. The FSIS 
laboratories have completed implementation of numerous policies, procedures, and 
safeguards that enhance security. These new requirements are for locks on all 
building and laboratory areas, freezers, and coolers to limit and control access to 
laboratones, samples, and pathogens. Additional measures included password 
protecting all essential laboratory computers to restrict unauthorized access. 


The Assistant Deputy Administrator, Office of Public Health and Science has also 
established a laboratory security team consisting of representatives from all 
laboratories and it 1s chaired by the Scientific Advisor for the Laboratories. This 
group had numerous meetings to identify and evaluate security issues. Each of the 
four FSIS laboratories worked together and, as appropriate, separately, to develop 
extensive standard operating procedures that detail measures and controls needed to 
improve security for each laboratory. In addition, the laboratones will be required to 
regularly conduct internal audits to ensure that all security and control policies and 
procedures are being followed. The Assistant Deputy Administrator (ADA) has also 
mandated that the Quality Assurance Division audit the security plan of each 
laboratory during the annual QAD audit, As part of an effort to evaluate the current 
state of security of the system, in mid-October the ADA directed the QAD to conduct 
an unannounced audit at each of the FSIS laboratories. Several deficiencies were 
noted and promptly corrected. 


This group has also drafted a Continuity of Operations Plan that details steps to be 
taken that will assist in carrying on the operations of the Laboratory System in the 
event of a local or national emergency. Included in this are plans to expand and 
enhance the capabilities of the FSIS laboratones for testing for selected biological and 
chemical agents in meat, poultry and egg products. 
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This will allow the FSIS laboratories to become a national resource that can be called 
upon during a bioterronsm incident. FSIS reaffirms its January 8, 2002, response to 
the Management Alert. 


2. Recommendation No. 2: 


Direct all agencies to instruct all USDA laboratories to immediately compile a 
comprehensive listing of biological agents handled or stored at their respective 
facilities and to forward this listing to the agency’s headquarters for consolidation at 
the Department level. This inventory record should include all laboratories, by 
agency, showing the biosafety level for each facility and a current inventory, which 
easily identifies all biological agents. Ensure that the inventory record is secure and 
can be readily accessed by managers at the headquarters level. Establish a date for 
accomplishing this task. 


Agency Response: 


All FSIS laboratories have maintained inventories of pathogens for several years. 
Two years ago FSIS expanded the inventory to include more information. After the 
September 11, 2001, tragedy, we asked the laboratones to check to ensure that the 
inventories were accurate and up-to-date. The inventories were forwarded to the 
Associate Deputy Administrator of the Office of Public Health and Science, FSIS. 
FSIS reaffirms its January 8, 2002, response to the Management Alert. 


3. Recommendation No. 3: 


Based on the inventory of biological agents for each facility, each agency should 
immediately assess the risk associated with such biological agents and determine the 
commensurate biosafety and biosecurity level for such agents. 


ency Response: 


The report inaccurately concludes we have no plans to perform a risk assessment and 
have offered no timeframe for identifying the biosecurity measures needed at their 
respective laboratories In fact a risk assessment was performed by our laboratones. 
A team with representatives from the laboratories was formed in September 2001. 


The team’s assessment and critique of laboratory procedures and operations have 
enhanced the existing security plans and identified opportunities for us to institute 
additional controls.) The resulting security plan addresses many of the key elements 
in the Department of Justice document, “Vulnerability Assessment of Federal 
Facilities," dated June 28, 1995. The laboratories generally comply with Level 11. 


FSIS has laboratories in GSA facilities and one is in an USDA, ARS-owned facility. 
The three laboratories are rated at Biosafety Level Class Uf and follow the appropnate 
standards and guidelines. Upon receipt of biosecurity funding support and 
completion of plans, an additional laboratory is under consideration for facility 
enhancements to comply with Biosafety Level Class IL. 
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4. Recommendation No. 4: 
Evaluate the results of security reviews conducted at two of the Department’s BSL-3 
laboratories (laboratories E and F) and begin implementing corrective actions related 


to security issues immediately. Arrange for security reviews of other USDA 
laboratories, starting with level-3 facilities. 


Agency Response: 
This recommendation is not applicable to FSIS. 
5. Recommendation No. 5: 


Immediately assess the feasibility of continuing current research and diagnostic 
activities at the facilities located in a strip mall. 


Agency Response: 
This recommendation is not applicable to FSIS. 
6. Recommendation No. 6: 
Take immediate action to correct the deficiencies at laboratory B, including the 
problems in inventory of biological agents, containment procedures, and physical 


security. 


Agency Response: 





This recommendation is not applicable to FSIS. 
7. Recommendation No. 7: 


Propose to the Secretary that one individual at the Department level be responsible for 
monitoring and reviewing the physical security at USDA laboratories to ensure the 
security is adequate. 


Agency Response: 


FSIS agrees to consider the merits of an individual at the Departmental level being 
responsible for monitoring and reviewing the physical security at the USDA 
laboratories to ensure the security is adequate. Such an individual could serve as a 
liaison between each USDA agency and share “lessons learned.” 


a 
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8. Recommendation No. 8: 


Immediately review security procedures to ensure access to high consequence 
biological agents is controlled and limited to authorized purposes. 


Institute management controls to ensure unauthorized removal does not occur by 
restricting access to facilities and laboratories handling or storing such high 
consequence biological agents only to personnel with authorized access and with the 


appropriate identification and requiring specific tracking on inventory records any 
removal and return of samples of high-level biological agents. 


Agency Response: 
See the FSIS response to recommendation No. 3. 


9. Recommendation No. 9: 





Immediately determine the necessity for background checks and security clearances 
for those personnel having access to high-level biological agents, particularly those 
with access to level-3 laboratories. Establish a protocol for approving authorized 
access to such materials. Also, work with the Department to reduce the backlog of 
security clearances. 


Agency Response: 





This recommendation is not applicable to FSIS. 
10. Recommendation No. 10: 
Immediately issue a notice to all laboratory facilities with high-level biological 
agents that they are to report any improprieties or vandalism involving such materials 


to the agency’s Headquarters office, which will in turn notify the Office of Inspector 
General and the other relevant offices. 


Agency Response: 
This recommendation is not applicable to FSIS. 


If you have any questions, please have your staff contact Vincent Fayne, Internal Control 
Staff at (202) 720-5959. 


CC: 


M. Glavin, OA P. McCaskey, OPHS_ P. Thompson, TSC B. Quick, CPA 
L. Swacina, OA J. Riggins, OPPDE K. Elane, PS H. Reuben, OGC 
J. Axtell, OM W. Smith, OFO V. Randecker,ASD 

E. Walker, OPHS C. Seymour, OFO T. Wright, ASD 


I 
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Exhibit E 


Response to the Draft Report From the Forest Service 
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United States Forest Washington Office 14'" & Independence SW 
Department of Service P.O. Box 96090 
Agriculture Washington, DC 20090-6090 





INFORMATION MEMORANDUM FOR JOYCE N. FLEISCHMAN, ACTING INSPECTOR 

GENERAL 

THROUGH. (Mark Rey yy 
V" Under Secretary, NRE Y 


FROM: Dale N. Bosworth Ode Cage Sijqi2z 


pe Chieti 





SU BIE Git Oversight and Security of Biological Agents at Laboratories Operated 
by the U.S. Department of Agriculture, OIG Audit Report No. 50099-13-At 


We have reviewed the draft report for the subject audit. As indicated in the Executive Summary, 
page 1 of the report, the objective of the audit was to determine the extent and location of agents 
that are pathogenic to humans or injurious to agriculture and the adequacy of safeguards to 
ensure the security of these agents. As we indicated in our response to the earlier Management 


Alert on the subject, the Forest Service laboratories do not house these types of agents. We have 


a single laboratory that contains small quantities of an agent that is injurious to insects. 
Nonetheless, we do have the following comments concerning the content of the draft report: 


1- Recommendation No. I: The Forest Service will, immediately upon issuance of the USDA 
policy and procedures concerning laboratory security, implement the requirements of those 
policies and procedures. We do not have laboratories that are classified BSL1, BSL2 or BSL3. 
We previously reported organisms at BSL1, but upon review by the USDA Facilities and Other 
Infrastructure Work Group it was determined these were not of a BSL character. 


2- Recommendation No. 2: The Forest Service has no BSL biological agents. Therefore no 
inventory is appropriate. Forest Service laboratories do work with plant and insect discase 
organisms. These agents are not dangerous to humans. An inventory of kind and location 1s 
being requested and will be consolidated at Forest Service headquarters. This inventory will be 
forwarded to USDA by June 1, 2002. An inventory of amount of cach organism is inappropriate 
because this can change on a daily basis as organisms are cultured for research studies or cultures 
are destroyed when studies are completed. 


3- Recommendation No. 3: Physical security risk assessments are being conducted or have been 
completed at most facilities. Corrective measures will be implemented in response to assessment 
findings. Since no BSL agents are present, there is no need to determine biosafety or biosecurity 
levels. 


4- Recommendation No. 4: Not applicable to the Forest Service. 
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Caring for the Land and Serving People Printed on Recycled Paper 
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INFORMATION MEMORANDUM FOR JOYCE N. FLEISCHMAN, ACTING INSPECTOR 
GENERAL 

Page 2 

S- Recommendation No. 5: Not applicable to the Forest Service. 

6- Recommendation No. 6: Not applicable to the Forest Service. 


7- Recommendation No. 7: Not applicable to the Forest Service. 


8- Recommendation No. 8: High consequence biological agents are not present in Forest Service 
laboratories therefore this recommendation is not applicable. 


9- Recommendation No. 9: The Forest Service does not utilize high-level biological agents in 
its laboratories therefore this recommendation is not applicable. 


10- Recommendation No. 10: Forest Service laboratories do not contain high-level biological 
agents therefore this recommendation is not applicable. 


Any questions concerning this information may be directed to Dr. Bov Eav, Associate Deputy 
Chief, Research and Development. Dr. Eav’s telephone number is (202) 205-1702. 


a Ores eee 
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Exhibit F 


Response to the Draft Report From the Agricultural Marketing Service 


USDA 
Se 


United States 
Department of 
Agriculture 


Marketing and 


Regulatory 

Programs 

Agricultural : 

Marketing ‘LO: Joyce Fleischman 

Service Acting Inspector General 

P.O.Box 96456 Office of Inspector General 

Washington, DC 

20090-6456 == THROUGH: Bill Hawks emake MAR | 8 2002 


a Under Secrétary 
Marketing and Regulatory 
FROM: A.J. Yates 


Administrator 
Agricultural Marketing Service 





Marche 5 e200 2 


SUS Cale: Oversight and Security of Biological Agents at Laboratories Operated by 


the U.S. Department of Agriculture 


Background 


This memorandum responds to your request dated March 8, 2002, requesting written 
comments on the draft of the subject audit report. We have listed each of the 
recommendations below along with our response. Additionally, we have provided a 
general comment concerning the correct biosafety classification at one of AMS’ 


laboratories. 


Recommendation No. 1: 


Hasten the implementation of the policies and procedures being prepared by the 


Department’s biosecurity task force. 


AMS Response: 


AMS currently has in place an SOP for the handling and storage of biological materials. 
We feel based on the level (BSL-2) of the materials within AMS, this SOP is sufficient. 
However, AMS is currently developing a new chapter to be included in our AMS Safety 
and Occupational Health Handbook addressing biosafety/security. The USDA 
Biosecurity Requirements for Biosafety Level 3 Pathogens and Facilities policies and 


procedures document is being used as general guidance. 


AMS - Agricultural Marketing Service 
@ An Equal Opportunity Provider and Employer 





USDA/OIG-Audit No. 50099-13-At 


44 






AA 


oe + a 
mort hogeA ster arf of sengeE 


) a be | : 
%~ i 


— 
ae 
<ong® 


A AAS ree 


*-1) 0008 ot tighed 
Trae 
le aeP 


ik 


ete 





} I 


Page 2 of 4 


Page 2 


Recommendation No. 2: 


Direct all agencies to instruct all USDA laboratories to immediately compile a 
comprehensive listing of biological agents handled or stored at their respective facilities 
and to forward this listing to the agency’s headquarters for consolidation at the 
Department level. This inventory record should include all laboratories, by agency, 
showing the biosafety level for each facility and a current inventory, which easily 
identifies all biological agents. Ensure that the inventory record is secure and can be 
readily accessed by managers at the headquarters level. Establish a date for 
accomplishing this task. 


AMS Response: 


AMS has an updated inventory of biological agents handled and stored at our facilities. 
This list is maintained at each facility with copies forwarded to AMS headquarters. 


Recommendation No. 3: 


Based on the inventory of biological agents for each facility, each agency should 
immediately assess the risk associated with such biological agents and determine the 
commensurate biosafety and biosecurity level for such agents. 


AMS Response: 


AMS does not handle or store BSL-3 or high consequence materials. AMS feels current 
security and safety measures in place are sufficient for materials handled and stored 
(BSL-2). ° 


Recommendation No. 4 
Evaluate the results of security reviews conducted at two of the Department’s BSL-3 
laboratories (laboratories E and F) and begin implementing corrective actions related to 


security issues immediately. Arrange for security reviews of other USDA laboratories, 
starting with level-3 facilities. 


AMS Response: 


Not applicable to AMS as no BSL-3 materials stored or handled. 


2 Oe enint 
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Page 3 
Recommendation No. 5: 


Immediately assess the feasibility of continuing current research and diagnostic activities 
at the facilities located in a strip mall. 


AMS Response: 


Not applicable to AMS. 
Recommendation No. 6: 


Take immediate action to correct the deficiencies at laboratory B, including the problems 
in inventory of biological agents, containment procedures, and physical security. 


AMS Response: 


Not applicable to AMS. 
Recommendation No. 7: 


Propose to the Secretary that one individual at the Department level be responsible for 
monitoring and reviewing the physical security at USDA laboratories to ensure the 
security is adequate. 


AMS Response: 


AMS concurs with this recommendation. 
Recommendation No. 8: 


Immediately review security procedures to ensure access to high consequence biological 
agents is controlled and limited to authorized purposes. Institute management controls to 
ensure that unauthorized removal does not occur by restricting access to facilities and 
laboratories handling or storing such high consequence biological agents only to 
personnel with authorized access and with the appropriate identification and requiring 
specific tracking on inventory records any removal and return of samples of high-level 
biological agents. 


AMS Response: 


AMS does not handle or store materials considered to be high consequence biological 
agents. 
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Recommendation No. 9: 


Immediately determine the necessity for background checks and security clearances for 
those personnel having access to high-level biological agents, particularly those with 
access to level-3 laboratories. Establish a protocol for approving authorized access to 
such materials. Also, work with the Department to reduce the backlog of security 
clearances. 


AMS Response: 


Not applicable as AMS has no level-3 biological agents. 


Recommendation No. 10: 


Immediately issue a notice to all laboratory facilities with high-level biological agents 
that they are to report any improprieties or vandalism involving such materials to the 
agency’s Headquarters office, which will in turn notify the Office of the Inspector 
General and other relevant offices. 


AMS Response: 


Not applicable as AMS does not have materials considered to be high-level biological 
agents. 


General Comment(s): 


AMS would like to take this opportunity to clarify what we believe was a 
miscommunication between AMS headquarters staff and your auditor, (page 9 last 
paragraph). The information provided to your auditor was based on the definition given 
to our staff by your auditor. The auditor asked about high level biological materials. The 
AMS response was that our laboratory does not handle or store such biological materials. 
The response was in no way intended to mean we have no biological material. The 
response merely addressed the question asked. We believe the mischaracterization 
resulted from poor communication between OIG and AMS staff, and incorrectly suggests 
that there was confusion with AMS concerning the presence of biological materials in 
one of our laboratories. 


cc: Richard D. Long 
Assistant Inspector General 
for Audit 
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Copies of this report have been distributed to: 


Under Secretary, Marketing and Regulatory Programs 
Under Secretary, Research, Education, and Economics 
Under Secretary, Food Safety 
Under Secretary, Natural Resources and Environment 
Assistant Secretary, Administration 
Attn: Agency Liaison Officer 
Administrator, AMS 
Attn: Agency Liaison Officer 
Administrator, APHIS 
Attn: Agency Liaison Officer 
Acting Administrator, ARS 
Attn: Agency Liaison Officer 
Acting Administrator, FSIS 
Attn: Agency Liaison Officer 
Chief, FS 
Attn: Agency Liaison Officer 
General Accounting Office 
Office of the Chief Financial Officer 
Director, Planning and Accountability Division 
Director, Office of Crisis Planning and Management 


Director, Office of Procurement and Property Management 


(2) 
(2) 
(2) 
(2) 
(1) 
(3) 
(1) 
(6) 
(1) 
(9) 
(1) 
(6) 
(1) 
(10) 
(1) 
(10) 
(1) 


(1) 
(1) 
(1) 
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